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‘Ui This Office fully supports the policy outlined in” 
paragrapn 2 of reference (b). This policy incidentally was First 
cucFacea in our joint OS/ODP Computer Security Working Group and, 
in fact, prior to final publication by the Office of Data ie, ee 
Processing (ODP), Management Staff (MS) was coordinated with the an 
Office of Security (OS), Information Systems. Security Group ete 
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“la. There is a distinct threat'to ADPE poth at the . 
manufacturing point.and/or at 'the setvicing ‘end via'a device 
‘used for the purpose already stated in reference (b)-. We 
pbelieve,- however, that there would pe better ways' fora. 
nostile or (friendly) government to obtain information but 
that threat nevertheless exntses. 2. he oo. Ge Gigs SE 
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es b. Regarding service representatives — any foreign’. 
ational representative of these manufacturers would not be 
permitted entry to the Headquarters complex for obvious . . 
‘security reasons. (U) vo ar - a a 8 
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3. In answer to specific questions Listed in attachment (1) 
af reference (a), we have the following comments ‘(corresponding 
ho paragrapns in attachment): 
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a. We view these parameters as the entixe system to 
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pincLude individual components of a computer, e.g-, main CPU, 

terminals, memory units, I/O Gevices, channel’ devices, as ; 


' well as .communication equipment. aay ; ace 
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‘ba’ We would - prefer page these be made at time of | 


“procurement as part: of-the procurement. process. Inquiries 
should be made as to Foreign affiliation and if possible 


- place of manufacture of computer units under procurement 


consideration. -There should be no exceptions unless there 
are overriding circumstances not now envisioned and then 
only with written concurrence by the Director. of Security 
and the SU EE GSLOr oF. ecan SRE OSS RTE ees a8 


eC. Hoe We ‘el beye. oe this is an futeenal: ‘Rosner 
policy matter necessitated by the DCI's legal: Fespons ibility 


“to protect Sources and Methods. DDO-data which is processed 
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seacaenen’: pe) ae implanted devices or for modifications: Oe 


3 7 service representatives: service 
technicians who. regularly maintain our computer equiment 
must. be cleared and badged (VNE badge includes polygraph - 
interview). Service personnel on the Agency account, wha 
‘regularly service our equipment but who .do not' qualify for a 
badge (less than 100 visits per year) ‘are also generally 
“appropriately cleared. In the event there are no badged or 


.. Cleared service personnel available, uncleared 
representatives will be asked to perform maintenance 


“functions: under escort by a "knowledgeable" individual.” OF 
“course this procedure “is difficult to enforce. in the daily 
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‘@, Yes. Weare: Sareenels reviewing Agency ania: 
SSoamonity policy in the information security area in order 
to update existing. regulations/directives and: will consider 
‘this question as part of that review. _ Additionally, we feel 
that it should also apply to the Intelligence Community 
‘(e.g., to member Agencies processing scr under; DCID - 1/16). 


£. To our How rede there is currently ney peliey 
Community-wide specifically addressing: this matter. Until 
very recently, as you know, there was a specific “buy~ 
American" clause in the GSA procurement ‘directives which now 
has been voided by Executive Order. Further, historically 
the United States computcr manufacturers have not had any 
competition from foreign companies. However, with recent 
technical strides in computer manufacturing by Japan, the 
‘problem of using foreign computers will become more defined. 
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h. ‘We are not’ as concerned sow United. States aenauter 
manufacturers using transnational corporations for parts, 
‘ete.,-as-we--are of foreign manufacturers producing this |. 
computer éguipment ‘in their own country under’ their, "total" 


pe eerie ‘In short; we have to live .with the: pT Eacts. of: Life™ 
~ of American BEF ENE SS ve | ea 


. . rr 7 ! 7 ate 
roe aes .¢ 7 : ae oe “ i wt 
. : Nees gst nee 2% v | : i « 

id pene : Pe bee . . 


2 ate ! 
Ata oan ve 


"Many aueceione: Senta first have to. be! answered “SacH: 
as! ' degree O£ foreign. ‘control; the-distribution process for 


ce this equipment, | fpee of contracts 5 (overt/covert) under 
‘7 eonsideration. (s) - e 
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